security.yml

# PR-focused security checks.
# Purpose: catch dependency vulnerabilities and leaked secrets before merge.
name: Security

on:
  # Security checks are required for all PRs into main.
  pull_request:
    branches: [main]

concurrency:
  # Cancel superseded security scans for the same PR.
  group: security-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  # Required by checkout and PR-context scanners.
  contents: read
  pull-requests: read

env:
  # Keep scanner runtime consistent across runs.
  PYTHON_VERSION: "3.11"
  # Pin Poetry CLI version for deterministic CI behavior.
  POETRY_VERSION: "2.4.1"
  # Keep Poetry virtual environments inside the workspace for deterministic paths.
  POETRY_VIRTUALENVS_IN_PROJECT: "true"
  # Pin pip-audit to avoid non-deterministic CI failures from tool updates.
  PIP_AUDIT_VERSION: "2.10.0"
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  security:
    # Single job that combines package audit and secret scanning.
    name: Dependency and Secret Scan
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install Poetry
        run: pipx install "poetry==${POETRY_VERSION}"

      - name: Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: poetry
          cache-dependency-path: poetry.lock

      - name: Install pip-audit
        run: pipx install "pip-audit==${PIP_AUDIT_VERSION}"

      - name: Install dependencies
        run: poetry install --no-interaction --no-ansi

      - name: Python dependency audit
        # Audit the exact dependency graph exported from Poetry.
        run: pip-audit --requirement <(poetry export --without-hashes -f requirements.txt)

      - name: Secret scan
        # Scan only PR diff range to reduce noise and speed up checks.
        uses: trufflesecurity/trufflehog@bcfcf73aaf4759d4dadc2783177c245a02792318
        with:
          path: ./
          base: ${{ github.event.pull_request.base.sha }}
          head: ${{ github.event.pull_request.head.sha }}